Fetch a pluginInfo.json on the browser's behalf

Backs the "Enter a pluginInfo.json URL" box on the Plugins page. The browser tries the URL directly first; this is the fallback for when that fails, which is normally CORS or a private repo needing the configured PAT. Restricted to GitHub hosts. Without that this is an open proxy: it fetches whatever URL the caller names and hands back the response body, so anyone who can reach FPP's web UI could read anything FPP's network can reach. The restriction costs nothing real -- a plugin is a git repo FPP clones from GitHub, and the credentialed path here is GitHub-PAT-specific already. A pluginInfo.json hosted elsewhere still loads via the browser's direct attempt when that host allows it; only the server-side fallback is GitHub-only.